What our scanner does and what it never will.
SurfaceCheckr is a passive external security-reporting tool. It reads what your site already serves to the public and grades it. If you found us in your access logs, this page tells you exactly who we are, how to spot our traffic, and how to opt out in one step.
- Public HTML and response headers
- Linked JavaScript
- The TLS certificate (handshake only)
- Public DNS records
- A fixed list of well-known sensitive paths
- Authenticate or log in
- Send attack payloads
- POST or write anything
- Extract user data
We never publish a grade for a domain whose operator hasn't asked. Results are visible only to the requester, through an unguessable UUID URL.
What every scan checks for.
A single scan runs 500+ built-in checks: fixed signatures we maintain in code, across security headers, TLS, exposed files, admin panels, leaked secrets, and DNS and email hygiene. On top of those, every scan is measured against two feeds we re-sync daily, so coverage grows without us touching the code. The number here is read live, never a figure we update by hand.
Every check is multi-signal gated: a status code plus a content signature, never a bare 200. We remove checks that fire falsely on healthy sites, because a wrong “critical” costs more than a missed one.
How to identify our traffic
The scanner uses a stable, self-identifying User-Agent:
Mozilla/5.0 (compatible; SurfaceCheckrScanner/1.0; +https://surfacecheckr.com/scanner-info)
Our scans egress from a dedicated host with the reverse DNS scanner.surfacecheckr.com, so a reverse lookup of the source IP identifies us directly.
See it and want to confirm it, or ask us to stop? Email [email protected].
Opting out takes one step.
Don't want SurfaceCheckr to scan your domain? Pick whichever is easier.
Email us
From any address at the domain, email [email protected]. We honour opt-outs within 24 hours.
Publish a file
Serve /.well-known/surfacecheckr-optout with the line surfacecheckr-optout in the body. We respect it immediately.
We check the file's contents, not just that it exists, so a catch-all server that 200s every path won't accidentally opt you out.
We scan gently.
Our crawler honours robots.txtDisallow paths for crawl behaviour: we report that they exist, but we don't crawl into them.
What we don't claim to be.
We don't replace a pentest.
We tell you what an attacker can see from outside, not what they can break.
We don't test the inside.
No authenticated routes, business logic, XSS, SQL injection, IDOR, or anything POST-based.
We don't let AI invent findings.
The AI in our report layer only interprets evidence the deterministic scanner already collected. It never manufactures findings.